(a) For each transaction for which the Secretary issues an initial determination that an ICTS Transaction is prohibited, the Secretary shall issue a final determination as to whether the ICTS Transaction is:
(1) Prohibited;
(2) Not prohibited; or
(3) Permitted, at the Secretary's discretion, pursuant to the adoption of negotiated mitigation measures.
(b) Unless the Secretary determines in writing that additional time is necessary, the Secretary shall issue the final determination within 180 days of accepting a referral and commencing the initial review of the ICTS Transaction pursuant to § 7.103.
(c) If the Secretary determines that an ICTS Transaction is prohibited, the Secretary shall have the discretion to direct the least restrictive means necessary to tailor the prohibition to address the undue or unacceptable risk posed by the ICTS Transaction.
(d) The final determination shall:
(1) Be written, signed, and dated;
(2) Describe the Secretary's determination;
(3) Be unclassified and contain no reference to classified national security information;
(4) Consider and address any information received from a party to the ICTS Transaction;
(5) Direct, if applicable, the timing and manner of the cessation of the ICTS Transaction;
(6) Explain, if applicable, that a final determination that the ICTS Transaction is not prohibited does not preclude the future review of transactions related in any way to the ICTS Transaction;
(7) Include, if applicable, a description of the mitigation measures agreed upon by the party or parties to the ICTS Transaction and the Secretary; and
(8) State the penalties a party will face if it fails to comply fully with any mitigation agreement or direction, including violations of IEEPA, or other violations of law.
(e) The written, signed, and dated final determination shall be sent to:
(1) The parties to the ICTS Transaction via registered U.S. mail and electronic mail; and
(2) The appropriate agency heads.
(f) The results of final written determinations to prohibit an ICTS Transaction shall be published in the Federal Register. The publication shall omit any confidential business information.